CVE-2023-25815

{"id": "CVE-2023-25815", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.8}]}, "published": "2023-04-25T20:15:09.997", "references": [{"url": "http://www.openwall.com/lists/oss-security/2023/04/25/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/msys2/MINGW-packages/pull/10461", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://security.gentoo.org/glsa/202312-15", "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2023/04/25/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/msys2/MINGW-packages/pull/10461", "tags": ["Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202312-15", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-134"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\mingw64\\share\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\` (and since `C:\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.\n\nThis vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\`."}, {"lang": "es", "value": "En Git para Windows, la versi\u00f3n de Git para Windows, no se env\u00edan mensajes localizados con el instalador. Como consecuencia, se espera que Git no localice ning\u00fan mensaje y omita la inicializaci\u00f3n de gettext. Sin embargo, debido a un cambio en los paquetes MINGW, la inicializaci\u00f3n impl\u00edcita de la funci\u00f3n `gettext()` ya no usa el prefijo de tiempo de ejecuci\u00f3n sino que usa la ruta codificada `C:\\mingw64\\share\\locale` para buscar mensajes localizados. Y dado que cualquier usuario autenticado tiene permiso para crear carpetas en `C:\\` (y dado que `C:\\mingw64` normalmente no existe), es posible que los usuarios con pocos privilegios coloquen mensajes falsos en esa ubicaci\u00f3n donde `git .exe` los recoger\u00e1 en la versi\u00f3n 2.40.1. Esta vulnerabilidad es relativamente dif\u00edcil de explotar y requiere ingenier\u00eda social. Por ejemplo, un mensaje leg\u00edtimo al final de un clon podr\u00eda modificarse maliciosamente para pedirle al usuario que dirija su navegador web a un sitio web malicioso, y el usuario podr\u00eda pensar que el mensaje proviene de Git y es leg\u00edtimo. Sin embargo, requiere acceso de escritura local por parte del atacante, lo que hace que este vector de ataque sea menos probable. La versi\u00f3n 2.40.1 contiene un parche para este problema. Algunas soluciones est\u00e1n disponibles. No trabaje en una m\u00e1quina Windows con cuentas compartidas o, alternativamente, cree una carpeta `C:\\mingw64` y d\u00e9jela vac\u00eda. Los usuarios que tienen derechos administrativos pueden eliminar el permiso para crear carpetas en `C:\\`."}], "lastModified": "2024-11-21T07:50:15.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:git_for_windows_project:git_for_windows:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E740B447-D96A-40C3-AFA9-9B058379E04D", "versionEndExcluding": "2.40.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}